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Face Recognition 

Face recognition is one of the 
biometric technologies 

Face recognition has 2 applications: 

Identification (Search for an unknown 
face in a database of faces...) 
Access Control (Authentication in 
buildings, in computers ...) 
Bkis research focus on access control 
systems and their security drawbacks. 




Face recognition authentication 

Let me show you a short video clip on Face 

Recognition Authentication 

Video 

We have just seen an advertisement video of 
a new feature of current laptops, which is 
authentication using face recognition 
technology. 

We observe that Candy, the owner of the 
laptop, does not have to type in her password 
to log in. She sits in front of the computer and 
let it recognize her face. 



Face recognition authentication 

At the moment, there are 3 laptop 
manufacturers that make use of this 
technology in their products. 

They are ASUS, TOSHIBA and LENOVO. 



Face recognition authentication 

Develop their own software with their own 
algorithms 
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Asus: Smart Logon 



Lenovo: Veriface 
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Toshiba: Face Recognition 



Face Recognition Authentication 
Drawbacks: Let's see 
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Laptop: F6S Series, X80 Series 

Software: ASUS SmartLogin ver 1 .0.0005 



ASUS 



Link to the software 
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Why? 

The answer is that during the research on the 
algorithm on face recognition technology 
applied for laptops, we found that the 
algorithm has some weaknesses. 

Based on that, a bad guy can create a fake 
face recognition. That can start from some 
simple pictures of the real owner, and 
combining with the manufacturer's algorithm, 
they can create the fake face recognition, as 
you have just seen. 
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Why? 

Face Recognition drawbacks 

1. Influences of changes in lighting 

• The basic algorithms have not worked well 
when there are changes in lighting. 

• In the latest performance measurement 
report of face recognition algorithms, the 
result was good only when the lighting did not 
change. 

• Will further modifications of the technology 
proposed by the three manufacturers solve 
this lighting problem? 
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Why? 

Face Recognition drawbacks 

2. Influences of image capturing devices 

• Built-in cameras manufactured by those three 
companies have low resolution (0.3 
Megapixel, 1.3 Megapixel and highest being 
2.0 Megapixel). 

• Might low resolution images become flaws 
that can be taken advantage of? 

• It's not the main reason of the vulnerability 
but it could make the algorithms easier to be 
broken. 
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Why? 

Face Recognition drawbacks 

3. Influences of Image Processing 

• All of the algorithms use digitalized 
images, which go through image 
processing. 

• This is the weakest security flaw in face 
recognition systems. 
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Why? 



Face Authentication System 
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Face Recognition Bypass Model 



How to have special images ? We will discuss more details later 
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Do the manufacturers know about it ? 

• When the manufacturers introduced this 
feature into these all laptops, did they 
recognize its weaknesses ? 

• And to find out the answer, let me invite 
you to see another video clip. 

• Watch the Video 
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Do the manufacturers know about it ? 



Yes 

The manufacturers have already paid 
attention to this issue. 

However, the algorithm has a fundamental 
flaw. 

Even though they have applied more 
technical modifications to reduce the 
weakness, they have not been able to solve it 
completely. 

It is not secure enough to serve as a security 
feature as advertised by manufacturers. 
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Laptop: L310, M300 

Software: Toshiba Face Recognition ver 2.0.2.32 



TOSHIBA 




Laptop: Lenovo Y410, Y430 
Software: Lenovo Veriface III 



Lenovo 
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Research results 

The Rate of Bypass Face Recognition Authentication Mechanism 
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Attack Scenarios 

1 . Obtain images of owner's face. 

2. Regenerate the fake face recognition 
suite -> Special images. 

3. Bypass the face authentication using 
these images 
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Attack Scenarios 

Video chat: MSN, Yahoo Messenger, AOL, Skype. 

Internet : Flickr, Yahoo Blog, Facebook ... 

i( i' ) 

Tele cameras: capturing from the far distance 

Invite owner to take a photograph with him/her 
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Attack Scenarios 
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Attack Scenarios 

This attack method is more difficult to 
notice: There is no change in your 
systems, and you still believe that your 
laptop is being protected, without knowing 
that somebody has logged on to your 
laptop with your photo. 

Different from someone resetting your 
password or connecting your laptop's hard 
drive to his computer. 
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Live demonstration 



Method of testing 
Lenovo Y430 
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Live demonstration 

While we are waiting for the result of 
creating the fake face recognition picture, 
we shall watch another short video. 

Watch the Video 
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Recommendation for manufacturers 

When we found out about the vulnerability, 
we sent warnings to manufacturers: Asus, 
Lenovo, and Toshiba. 

However, they have not given any official 
response yet. 

This is an irresponsible act of these three 
manufacturers toward their customers. 
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Recommendation for manufacturers 

Our research results show that the face 
recognition technology being used by 
Asus, Lenovo and Toshiba is not secure 
enough to protect users. 

We assert that, there is no way to fix this 
vulnerability. 
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Recommendation for manufacturers 

• Below are our recommendations to the 
manufacturers Asus, Lenovo, Toshiba: 

1 . Stop developing this technology and 
remove it from all the models of their 
laptops. 

2. Give an official advisory to global users: 
Stop using this function. 
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